3 ms·
I'm holding off buying WebAuthn stuff until fabled YubiKey Bio comes out since WebAuthn support is still so insignificant even compared to TOTP. But big players
by xaduha 5y ago
I'm holding off buying WebAuthn stuff until fabled YubiKey Bio comes out since WebAuthn support is still so insignificant even compared to TOTP. But big players like Cloudflare supporting it might change the picture.
- ec109685 5y agoApple is adding built in support to iOS: https://arstechnica.com/information-technology/2019/12/idevices-finally-get-key-based-protection-against-account-takeovers/?amp=1 https://arstechnica.com/information-technology/2019/12/idevi...
- jrockway 5y agoIt's already in there and ready to be used. I wrote a small IDP/authenticating proxy that uses it, and I can now log in to my stuff with FaceID. Or you can hold your old-school Yubikey up to the phone (that you enrolled on your workstation!) and use that instead. It is all very seamless. There is absolutely no reason to have passwords anymore. You can't phish WebAuthn. It's built into every modern phone and PC. (There is some concern about it being easier to lose access to your account, but account recovery already exists for the three remaining people that don't use a password manager, and forget their passwords. If you're implementing it, do let users add multiple tokens, though. That way they can have a backup and easily enroll new devices.)